When OFAC and the EU Spell the Same Name Differently, What Are You Liable For?

It is a question experienced practitioners run into constantly but rarely see answered head-on. A person is designated by both OFAC and the EU. OFAC’s SDN entry romanizes the name one way; the EU’s Official Journal renders it another. Your screening system matches one string cleanly and scores the other below threshold. If a transaction slips through against the spelling you did not catch, what exactly is the liability – and is “we ran a standard edit-distance match” a defense?

The short version: you are liable for the person, not the spelling, and the expectation clearly goes beyond raw edit distance. Here is the reasoning, with the supporting regulatory language.

1. The obligation attaches to the designated person, not to a romanization

OFAC’s prohibitions run against the designated person and that person’s property and interests in property. The name spellings, aliases, and other identifiers published in an SDN entry are aids to identification; they are not the legal definition of the target. That distinction matters because it means a spelling discrepancy between OFAC’s list and another regulator’s list is not, by itself, a shield. You cannot defend a missed match by pointing out that OFAC and the EU transliterated the underlying name differently, because your obligation was never keyed to a specific Latin string in the first place.

This is reinforced by the strict-liability character of most OFAC prohibitions. Civil liability under IEEPA-based programs does not require intent or knowledge, so “the file we screened against spelled it differently” is not a recognized excuse. It goes to mitigation, not to whether an apparent violation occurred.

2. Each list is authoritative in its own jurisdiction – so you screen against each as published

OFAC, the EU, the UN, and OFSI transliterate Arabic, Cyrillic, Farsi, and Chinese names using different conventions. The same human being legitimately produces different Latin strings across the lists – Mohammed / Muhammad / Mohamed; Qadhafi / Gaddafi / Kadafi; hyphenated, spaced, or dropped “Al-” prefixes. Each list is, in its own jurisdiction, the authoritative legal instrument. A firm subject to more than one regime is therefore expected to screen against each list as published and to reconcile the fact that one person maps to several spellings across them. There is no regulator that publishes an explicit “you must reconcile our transliteration against the EU’s” rule – the expectation is inferred from how the obligations are framed and enforced, not from a single on-point statement.

3. Does the expectation go beyond standard edit-distance matching? Yes – and OFAC has said so in substance

Edit distance (Levenshtein, Jaro-Winkler, and similar) is treated as necessary but not sufficient. OFAC does not prescribe an algorithm, but its guidance and enforcement record point squarely at the failure modes that character-level distance handles poorly.

In A Framework for OFAC Compliance Commitments (May 2, 2019), OFAC identifies deficient screening as a recurring root cause of apparent violations, and it specifically calls out the failure to account for alternative spellings of designated parties. Commentators summarizing the Framework note that OFAC warns screening software must, among other things, account for alternative spellings of prohibited firms or people – the Habana / Havana example is OFAC’s own. That is the closest thing to a direct statement that naive string matching is not enough.

Why edit distance alone falls short in the cross-list transliteration scenario:

• Cross-alphabet variance. Two valid romanizations of one name can sit at a large character-level distance from each other. “Qadhafi” versus “Kadafi” is a big edit distance but the same person. A threshold tight enough to suppress false positives will miss these; a threshold loose enough to catch them floods the review queue.
• Phonetic equivalence. Names that sound alike but score as distant (the “Mohammed” / “Muhammad” family) are better bridged by phonetic logic (Soundex, Metaphone) or transliteration-aware normalization than by raw distance.
• Name-order and segmentation. Arabic kunya/nasab structures, Chinese surname-first ordering, and dropped or added particles defeat token-by-token distance scoring.
• Culture and script-specific normalization rather than a single global threshold applied to every population.

4. The enforcement record: tool tuning for name variants is a cited deficiency

Two settlements make the point concretely, and neither turns on willful conduct – both are about how the screening tool was configured.

Apple / SIS (FNKSR, 2023 settlement). As part of resolving apparent violations tied to a designated Slovenian developer, OFAC highlighted remedial measures Apple undertook, including reconfiguring its primary screening tool to fully capture spelling and capitalization variations and to account for country-specific business suffixes, plus annual review of the tool’s logic and configuration. The remediation itself tells you what OFAC viewed as the gap: a tool that did not adequately capture variant spellings.

JPMorgan Chase (FNKSR and Syria, 2018 Finding of Violation). OFAC found that the bank’s screening system, as configured over a multi-year period, failed to identify customer names with hyphens, initials, or additional middle or last names as potential matches to identical or similar names on the SDN List – and that staff did not escalate the red flags despite matching addresses and dates of birth. Again, the deficiency is in the matching logic and the procedures around it, not in the absence of screening.

The through-line: OFAC does not penalize you for the existence of a spelling difference. It looks at whether a reasonable, risk-appropriate program – with fuzzy matching, phonetic and transliteration handling, and periodic tuning and testing – should have caught the target. A tool that “ran” but was mis-tuned to variant spellings is treated as a deficient program.

5. How the liability actually resolves

Put the pieces together and the liability is not “for the spelling” as such. It is for processing a transaction involving a designated person you should reasonably have identified. If your program screens against OFAC’s spelling with matching logic calibrated to catch reasonable variants, and a genuinely divergent EU transliteration was the only version that would have matched, OFAC’s inquiry is whether a reasonable, risk-based program should have caught it anyway. A documented, risk-based methodology – fuzzy plus phonetic and transliteration-aware matching, with periodic tuning and testing – is simultaneously the compliance expectation and, under OFAC’s Economic Sanctions Enforcement Guidelines, a mitigating factor if something still slips through.

Bottom line

No regulator publishes an express “reconcile our transliteration against the EU’s” instruction. But the combination of three things – strict liability, the principle that the obligation runs to the designated person rather than to a designated spelling, and OFAC’s explicit citation of alternate-spelling failures as an enforcement root cause – produces a clear expectation. Screen against each authoritative list as published, and use matching logic that goes beyond raw edit distance to account for transliteration, phonetic, and structural name variation. Edit distance alone, without transliteration and phonetic handling and risk-based tuning, would most likely be viewed as a deficient program.

---

Source confidence. The Framework‘s treatment of alternate spellings as a screening root cause, and the Apple/SIS and JPMorgan Chase remediation details, are well supported by OFAC’s published materials and settlement summaries. The broader proposition – that this framework requires cross-list transliteration reconciliation – is inference drawn from the Framework, the enforcement record, and the strict-liability structure, rather than from a single on-point OFAC statement, because OFAC has not issued express guidance addressing cross-regulator transliteration divergence directly.

Key references: OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), Appendix root-cause analysis; OFAC settlement with Apple Inc. under the Foreign Narcotics Kingpin Sanctions Regulations; OFAC Finding of Violation involving JPMorgan Chase (FNKSR and Syrian Sanctions Regulations, 2018).